drm/xe/eustall: Fix a possible pointer dereference after free

If devm_add_action_or_reset() isn't successful, xe_eu_stall_fini()
is invoked. So, unsuccessful return from devm_add_action_or_reset()
shouldn't dereference gt->eu_stall as xe_eu_stall_fini() already
frees it. Fix this issue.

Fixes: 9a0b11d4cf3b ("drm/xe/eustall: Add support to init, enable and disable EU stall sampling")
Signed-off-by: Harish Chegondi <harish.chegondi@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/eae49a414a7314921108e0388810aaee6261ad92.1741800396.git.harish.chegondi@intel.com

diff --git a/drivers/gpu/drm/xe/xe_eu_stall.c b/drivers/gpu/drm/xe/xe_eu_stall.c
index 88a92baf5c95dad18a4d2e6fdf677e0bc53f141f..f2bb9168967c2be6837517f96a6709b5274cc442 100644 (file)
--- a/drivers/gpu/drm/xe/xe_eu_stall.c
+++ b/drivers/gpu/drm/xe/xe_eu_stall.c
@@ -222,13 +222,7 @@ int xe_eu_stall_init(struct xe_gt *gt)
                goto exit_free;
        }
 
-       ret = devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt);
-       if (ret)
-               goto exit_destroy;
-
-       return 0;
-exit_destroy:
-       destroy_workqueue(gt->eu_stall->buf_ptr_poll_wq);
+       return devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt);
 exit_free:
        mutex_destroy(&gt->eu_stall->stream_lock);
        kfree(gt->eu_stall);